Security update for php-composer2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2026:0825-1 Final 1 1 2026-03-05T15:16:16Z current 2026-03-05T15:16:16Z 2026-03-05T15:16:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php-composer2 This update for php-composer2 fixes the following issues: CVE-2025-67746: Fixed ANSI control characters injection in the terminal output of various Composer commands via attacker controlled remote sources. (bsc#1255768) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2026-825,SUSE-SLE-Module-Web-Scripting-15-SP7-2026-825,openSUSE-SLE-15.6-2026-825 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2026/suse-su-20260825-1/ Link for SUSE-SU-2026:0825-1 https://lists.suse.com/pipermail/sle-security-updates/2026-March/024634.html E-Mail link for SUSE-SU-2026:0825-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1255768 SUSE Bug 1255768 https://www.suse.com/security/cve/CVE-2025-67746/ SUSE CVE CVE-2025-67746 page SUSE Linux Enterprise Module for Web and Scripting 15 SP7 openSUSE Leap 15.6 php-composer2-2.6.4-150600.3.6.1 php-composer2-2.6.4-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 php-composer2-2.6.4-150600.3.6.1 as a component of openSUSE Leap 15.6 Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue. CVE-2025-67746 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:php-composer2-2.6.4-150600.3.6.1 openSUSE Leap 15.6:php-composer2-2.6.4-150600.3.6.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260825-1/ https://www.suse.com/security/cve/CVE-2025-67746.html CVE-2025-67746 https://bugzilla.suse.com/1255768 SUSE Bug 1255768